Cisco Unity Connection vulnerabilities

65 CVEs affecting Cisco Unity Connection, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20035, published 2026-05-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability, published 2026-01-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-01-21. EPSS: 4.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &…
CVE-2015-6360, published 2016-04-21. High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days. The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.
CVE-2017-12337, published 2017-11-16. Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain…
CVE-2014-3333, published 2014-08-11. High severity, CVSS 9.0. EPSS: 3.1% chance of exploitation in the next 30 days. The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files…
CVE-2014-0664, published 2014-01-10. Medium severity, CVSS 6.8. EPSS: 2.8% chance of exploitation in the next 30 days. The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug ID CSCul49976.
CVE-2021-1362, published 2021-04-08. High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &…
CVE-2017-6629, published 2017-05-03. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected…
CVE-2012-0367, published 2012-03-01. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services crash) via a series of crafted TCP…
CVE-2024-20253, published 2024-01-26. Critical severity, CVSS 10.0. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This…

Latest

CVE-2026-20035, published 2026-05-06. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to…
CVE-2026-20034, published 2026-05-06. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is…
CVE-2026-20081, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the…
CVE-2026-20078, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the…
CVE-2026-20061, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit…
CVE-2026-20060, published 2026-04-15. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is…
CVE-2026-20059, published 2026-04-15. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the…
CVE-2025-20278, published 2025-06-04. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an…
CVE-2024-20305, published 2024-01-26. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…